To start, we have exchange 2007 running and I am attempting to connect to it with Outlook 2007. I am able to connect through the OWA, we have POP access up and running, the only thing I can't do is connect through the outlook anywhere. From everything I've read its supposed to be extremely simple. Just enable it, go to outlook and connect, thats pretty much the extent of what I can find for support. Here is our setup. The mail server is at mail.mydomain.com. We can connect successfully to mail.mydomain.com/owa. The pop at mail.mydomain.com is also functioning. If i open up the mail feature on my system and create a new account and let it do the auto discovery by using the email myemail@mydomain.com it gets past the first step of network connection, but fails at the next step where it needs to find the settings server. There is no message there or anything to give me any clue as to the issue. If i manually set it up using mail.mydomain.com as the server and under the HTTP settings i tell it to use that same domain for access and it will not work. I get a message "The action cannot be completed. The connection to Microsoft Exchange is unavailable. Outlook must be online or connected to complete this action". The best result i've had is now it will autodiscover the domain but it can't find an encryptyed connection so it will automatically set it up as a pop3 connector. I really need to have Outlook anywhere working, where do i go from here?

Just some thoughts here since outlook anywhere does actually work "out of the box" with Exchange 2007:Have you installed the RPC Proxy service? this is done from Add/Remove Programs > Windows Components > Network Services > Rpc Proxydoes your network firewall allow connections to mail.mydomain.com on port 443 (ssl)?What certificate are you using on your exchange server, self signed, internal CA or Trusted Public CA? does it include the required subject alternative names?Assuming all of the above are OK, have you made sure the mailbox you are connecting to is Outlook Anywhere enabled, A/D has replicated and should all else fail restarted the server? (You should not have to restart but in some extreme cases this has helped me.

ok, we are having a similar problem. RPC proxy is installed and we have a 3rd party certificat we bought. I can use OWA no problem but when I try to connect using RPC/HTTP, I get a log in screen and my password is not accepted.Alex

same problem here as well. has anyone found a solution yet?

Me three. My Exchange 2007 environemt is runnuing on it's own domain in a datacenter. I have the same problems, in that I can get into Webmail externally, I just can't get a Outlook client to connect to my Exchange 2007 server. IT will come up with a login prompt and it doesn't seem to matter what credential I use. I did however take a laptop down to the datacenter, join that domain and had no problems even with autodiscovery , but when trying to connect externally no go. Help...

Hi, just to add one important thing here. regarding to the certificate, when you access OWA from internal or external, do you recieve a certificate warnings or errors? that your certificate is not trusted or something ? please note that, in order to use outlook anywhere from outside, your certificate should contact the Root certificate Authority ( Root CA) and you should not get any Pop Up warnings for the certificate, if you recieve this warning, then Outlook Anywhere will not work, even if you have all the correct configuration from internal. your cerficiate should be working without any warnings or problems, and it should be trusted, if you are using Microsoft CA Server located inside, then you need to export the Root CA from that internal server and install it on the client that is trying to connect from outside. if you are using a third party certificate, then you have to install its Root CA internally on your exchange servers, and make sure that the root certificate of that third party CA is available under the certificate store of the client and under trusted certificates as well. Regards Alaa Al-Ankar

No certificate errors for me, I ponied up the big bucks and got a Unified Communications cert from Digicert.com

Ok, i want you to test the outlook anywhere from inside your network, here is what you need to do: there is an option under your outlook anywhere settings under you outlook profile , i want you to choose it: on a fast network, connect using HTTP first, then connect using TCP/IP. then close outlook profile properties, and then open your outlook. it will ask for user name and password, remember to put the user name format as "Domain\User", then the password. if you could open outlook successfully, press CRTL Key, then right click on the outlook icon on the right down corner of your desktop, which appears in the task bar. then click on connection status. make sure that you see under "Conn" column " HTTPS " not " TCP/IP", if you see HTTPS , then you are connecting to your mailbox using Outlook Anywhere, and if you see TCP/IP, then you are connecting using MAPI. another thing to check, make sure that these settings are correct under your outlook profile: under connection settings inside exchange proxy settings, make sure that you choosed "Connect using SSL Only. and then check the option under it where it says "Only connect to proxy servers that have this principal name in thier certificate: msstd:<FQDN of the public name that was mentioned on your SSL certificate, which is the same as your OWA URL or public name>. don't choose the first option which is on fast network, i've mentioned above to choose it only to test the connectivity for Outlook anywhere from inside, then you need to remove it when you are accessing your outlook from outside. choose second optoin, where it says on a slow network, connect ...................... . last important settings, which is under Proxy Authentication settings, choose Basic Authentication, not NTLM. please let me know the result of the test from the first steps, and confirm the settings metioned on the second part. regards Alaa Al-Anakr

I can see you are an Exchange 2007 God. I do have another question for you. When connecting to Exchange via https on a machine that is not part of the domain, i have to manually change the login prompt because it only comes up with the username with the followingdomain\username. Is there any way to have it remember the domain\username so I don't have to change it every time I login?

well, first of all , i am not "Exchange 2007 God" . second, when you logon successfully to RPC over HTTPS using outlook, outlook will always remember the user name that was last logged on successfully to outlook, so there is no need to remember the user name since outlook will always show you the last successful logged on user. second, for providing a user name and password automatically to outlook so outlook will not ask for the credentials , well , since RPC over HTTPS is configured for Basic Authenication, then it will always ask for the credentials, but outlook will always remember the last successful logged on user, so no need to remeber the Domain\User of yours. i am not sure if you configured your exchange to use NTLM instead of Basic Authentication the behaviour will change. see ! i am not Exchange God i hope that the above posts helped you in answering your question from normal exchange professional if yes, then please rate this post Regards Alaa

Your post has been very helpfull and I'm sure to rate it highly, however can you elaborate on where in the console I could find the NTLM or Basic Authentication setting? My problem is that for some reason all the test clients that I use to connect to my new Exchange 2007 server don't remember the last login so instead of Domain\Username, what behavior I'm seeing is that whenever I start Outlook on any of my test machines even after having been logged into my mail server , the login prompt just has the username. I picked a really long domain name for some reason and changing it everytime to get into the mail server on a machine that is not part of the domain is probably not something my people will stand for. I remember when I first setup the Exchange i did have a prompt to choose Basic or NTLM , is there anyway to change that, or do I have to start over with re-installing Exchange?

NTLM or Basic Authentication is a settings not an option to choose via the prompt. it is settings under the Outlook Anywhere Settings which is part of your outlook. check these steps: go to Mail under control pannel, and double click on it. click on Show Profiles. choose the RPC over HTTPOutlook profile, and choose properties. click on Email Accounts. on the Email Accounts Page, and underEmail Tab, double click onyour email settings under "Name" Column (assumes that you haveOutlook 2007). on the Microsoft Exchange Settings Wizard, make sure that under Microsoft Exchange Server , the server name mentioned here is the actual Mailbox Server name, not anyother name. then click on More Settings. go to connection Tab. at the end of connection tab screen, and under "Connect to Microsoft Exchange Using HTTP", click on Exchange Proxy Settings. in the Proxy Settings , and under Connection Settings, make sure that you specify the URL of our public name which is reachable from outside for your exchange OWA, for example, if you are using OWA from outside by "mail.yourdomain.com" , then here you should specify this url. under "Connect using SSL Only" settings, make sure to choose the option below it as well, which is "Only connect to proxy servers that have this principal name in thier certificate:" and then specify the OWA url in teh following format " msstd:mail.yourdomain.com". then, in the two check boxes, choose second one "on slow networks, connect using HTTP first, then connect using TCP/IP. Now, this is the settings i am talking about, under "Proxy Authentication settings" click on the arrow to see the drop down list, where there should be only two options, first one which is "Basic Authentication" and second one is "NTLM Authentication" , here you HAVE to choose Basic Authentication, not NTLM. click OK on all the screens till you exists from the outlook profile settings. run outlook, and provide the user name and password in the format of "Domain\User". if your back end servers and network was configured well, then you should be able to access your outlook using RPC over HTTP without any problem. now, after all the above steps, i will be very sad if you still have a problem please let me know the status of your problem. Regards Alaa

Unfortunatley, the same behavior still persists. I do plan on linking my sites down the road bringing the domain to all myoffices but in the mean time this sure has me stumped. It wouldn't be so bad if I hadn't picked the worlds longest domain name, but I did. There has to be something I can do to just keep the machines remembering the domain name. Thanks for sharing your expertise though.

Please try to test the RPC over HTTPS from inside the network as i mentioned on my previous steps, and let me know if you can connect to our mailbox using outlook anywhere or not. we want to eliminate the problem, from internal or external. Regards Alaa

Internally, if I try to start Outlook from a laptop that has been joined to the domain, I don't even see a logon screen, it opens right up which is the behavior I would expect from Oultook Anywhere from inside the domain.

no you should not logon without asking for the credentials if you choosed the option where it says " on fast network, first connect using HTTP , then connect using TCP/IP" if you choosed that option from under exchange proxy settings under the user profile, then even from internal you should connect to our mailbox using anyhwere connectivity (RPC over HTTP). please review my previous posts, i explained to you with the steps how to configure your outlook to connect to RPC over HTTP from internal. you should be prompted for a user name and password from internal as well when you choose that option. please review my previous posts and let me know the status. Regards Alaa

I had the same problem. OWA worked without any issues but Outlook Anywhere kept prompting me for credentials and no matter which crendentials I used it would not work.The issue was that the certificate that I had created was issued to the FQDN of the server which is not what I was using for my OWA/CAS site. I was using "owa.domainname."After opening a ticket with MS they advised me to redo the certificate so that the issued to was "owa.domainname" and also move the "owa.domainname" to be the first subject name.I applied the new certificate and the credentials were taken right awayLet me know if this is not clear to anyone.

Well, since while you are using OWA you are not been prompted with SSL Warning or certificate error ? then the certificate is valid. cause the poster confirmed that he is not getting any warning messages while using OWA from internal or external. can you please let me know from where you purchased the SSL Certificate ? make sure that the root of this certificate is installed on your outlook client under trusted root certificates, if this is a public certificate then the Root CA of that vendor will be available under thr trusted root certificates on your client. please let me know from where you purchased your SSL certificate ? as i mentioned before, if your SSL certificate can not be validated or if you recieves SSL warning while using OWA, the RPC over HTTPS will not work. please confirm that. Regards Alaa Al-Ankar

I was not recieving any certificate errors or warnings either when using OWA. This was fixed by adding the correct subject names to the certificate and also installing the root CA certificate on the machine.Even though OWA was working perfectly, Outlook Anywhere would not connect until I requested and issued a certificate with "owa.domainname" in the "Issued To" field. After I enabled the new certificate OWA and Outlook Anywhere worked great.I did not purchase the certificate through a 3rd party. We operate our own internal CA so I requested a certificate from there. As long as the root CA certificate is in the trusted root CA store this approach will work. The only downside to this approach is that when employees hit the OWA site from public computers they are given a warning about the certificate and are prompted to accept our certificate. We train them to accept the warning on all company sites.Since we operate our own CA it was very easy to implement this fix...took less than 5 mins.

I have nearly the same problem. Somehow better, somehow worse. Bought and installed Verisign certificate for mail.mydomain.root. Works finewith OWA. But Outlook Anywhere does not. As in topcistarter message it reoprts 'Outlook should be online...'. Definitely, no autoconfiguration is awailable. I tried rpcping and receive 'Exception 1722' when trying the whole process, and 'Success' when trying with -E. Checked with Network Monitor - SSL connection really gets established. So I suppose, that RPC Proxy could not locate Exchange? As for other configurations: I have quite basic setup, where DC, Exchange, DNS and RPC Proxy are the same server, named someanothername.mydomain.root, where mydomain.root - is normal internet domain as domain.com... Server is in datcenter and I can not tell what kind of firewall protects it, athough could definitely say that there is one.;-) That also means, that I could not test anything from internl network (but I have remote access to Exchnge, definitely). Test laptop is not a member of the domain, so I've set 'ask for username' whereever it possible. Tried to set 'Exchange Server' option as mail, mail.mydomain.root, someanothername.mydomain.root, someanothername... As it where suggested, Proxy setting was set to mail.mydomain.root. I mentioned in some Microsoft article that RPC Proxy server should be able to resolve Exchange server... What doe it mean - to resolve it as DNS? As A or MX record? (actually that does not helps)... Coud anyone be so glad to help me with this stuff?

i have same problem ?

Hi Nadeem, Some ideas / suggestions to try out- Check to see that you have the correct Server Name Specified in the RPC/HTTPS Configuration Exchange 2007 Management Console/Server Configuration/Client Access/Server Properties/Outlook Anywhere (This is normally the public url used to connect to OWA & MUST be the first subject name of your certificate) Check the DNS on you machines which are not joined to the domain, they should be able to successfully resolve the internal fqdn of (i) your exchange CAS, (ii) your exchange MBX Server & (iii) your Domain Controllers/GC from CMD > NSLOOKUP server.domain.local To solve your Username Login Problems / Inconvenience, you could just add an additional UPN Suffixes to your Active Directory: Active Directory Domains & Trusts / Right Click the ROOT & Properties / Add your public smtp domain as an Alternate UPNSuffix Goto Active Directory Sites & Services, Change the UPN Suffix on the User Properties under Accounts to the one you added, now logon as user@domain.com I think if you check your connection status (Ctrl+click on the Outlook Icon in task bar) then you will find that internally you are connecting with TCP/IP when joined to the domain which uses Single Sign On authentication for the logged in user account. Also check if your firewall is blocking / allowing internal clients to access the LAN via your public IP to which OWA is published since this is how RPC/HTTPS is trying to connect to your cas server. Another possible work around is to create a split dns infrastructure for your public smtp domain name & add the Public OWAHostName to that pointing to the CAS IP for internal access. Provided your NSLOOKUP resolves the internal host names without any issue & you have a split DNS / are able to come back into your network on the Public IP from inside then all should be rosey. Alaa, its good to see you here mate, loong time it has been! Even with using NTLM Authentication, you will still be prompted for Username / Password by Outlook since integrated authentication requires you to have a valid login ticket against your account, which is usually not the case when connecting from another network / outside of the domain.

Hi All,I had similiar problems that others posted here even after Alaa posted his message. After doing some digging around the web and docs, I was able to resolve my problem.First, I ran the command:Test-OutlookWebServices -identity administrator | format-listInfoWhich generated an error when it went to test the RPC/HTTP (I didn't save a copy of the error. sorry)<snip>Id : 1017Type : SuccessMessage : [EXPR]-Successfully contacted the RPC/HTTP service at https://mail.globalscholar.com/Rpc.<snip>This line intially had an error as it was trying to use https://servername.domain/RPC instead of https://FQDN/RPC. Once I fixed this in the Exchange Management Console and reran this test did this generate a sucessfull test.However, after the above fix I was still having issues.I then ran:Get-OutlookProviderName Server SSL---- ------ ---EXCH EXPRWEB Which showed NULL values under server. To assign a server to EXCH and WEB, I ran:set-outlookprovider WEB -server FQDNset-outlookprovider EXCH -server FQDNOnce I added these two proviers, everything started working.I hope this helpsThanks Alaa for your post. I wouldn't have been able to get things working without your help.

I'm having issues with getting mine to work EXTERNALLY. It works fine internally, using the connection test it tells me im using https. When i try to connect externally, it prompts me for username and password, but it just hangs for a minute or so and then fails. im using the same exact credentials. The firewall 443 is open and OWA works fine with a 3rd party cert i installed. Any ideas what this could be would be greatly appreciated. Thanks.

Have you checked the authentication type being used for Outlook Anywhere? Exchange Management Console > Server Configuration > Client Access > CAS Server Properties / Authentication My guess, from your problem description is that it is set to NTLM Authentication, try changing this to Basic Authentication & see how it performs then. Some Corporate Firewall solutions do not allow NTLM authentication to pass through them (e.g. some of theCisco Pix, Nortel Connectivity) & as a result Outlook Anywhere works Internally but not Externally due to Authentication problems.

see www.exchangeninjas.com, it' one of the dense and meaningful site on exchange 2007, their script to configure virtual directory of cas it's the best thing of the year, and it also explain much the intricacies of Exchange 2007 web services Nest, couple outlook 2007 logging and test of autodiscovery ( ctrl-right click of outlook iconin the traybar ) gave us %temp%\olkdisc.log who is the best troubleshooting tool for outlook anywhere. Remember, you have to differenciate the url for inside our outside access or implement split dns configuration for differentiate inside our outside Outlook Anywhere access, and implement certificates with every fqdn you can think of for CAS & EWS access.

I ran into this exact problem, and it was exactly what everyone said. I had not listed the PUBLIC URL as the main name. Here's how to get the cert: My server's name is: exchange My server's internal FQDN is: exchange.domain.local My public URL is: mail.domain.com I also use autodiscover, so : autodiscover.domain.com Change the command to matach yours, then cut/paste the following into the EMS. New-ExchangeCertificate -DomainName mail.domain.com, autodiscover.domain.com, exchange.domain.local -FriendlyName "mail.domain.com SAN Certificate" -GenerateRequestTrue -Keysize 1024 -path c:\REQUEST.mail.domain.com.txt -privatekeyExportabletrue -subjectName "c=us, o=DOMAIN, CN=mail.domain.com" The take the c:\REQUEST.mail.domain.com.txt and give that to your Cert authority. (I use GoDaddy, as they're ~$60 per year and they work with everything...) Once you get the verification, you will need to import their cert (mine here is called C:\download\mail.domain.com.crt) into Exchange using the following command. (Note you could add ", IMAP, POP3" onto the end to enable it for other services. Import-ExchangeCertificate Path C:\download\mail.domain.com.crt | Enable-ExchangeCertificate Services SMTP,IIS Having done this, you will need to go into the IIS Management console, and make sure that your IIS server is using THIS certificate... I hope that this helps. Nick. PS. DAMN SMILEY's. The is really a COLON and DOLLAR.

Finally it worked. ( Outlook Anywhere ) 1 - Checked the certificates ( valid 'til 2020) 2 - Checked RCP ( Kerberos, use Http first, basic auth.) 4 - Checked IIS ( some events were fix, services.) 5- Restarted the Exc-Server ( problem were solved afterthis step ) Thanks all for the brain storm.

Guys what is the exact configuration for outlook Anywhere to avoid password prompt when use open it's outlook using internet? i am using MS exchange 2007, valid SSL certification, Outlook Anywhere enabled with NTLM Authentication. For the client i use the following configuration (Outlook 2003): In the Security Tab, Encrypt Data between Outlook and Exchange is checked In connection Tab, Connect to my exchange using HTTP is checked. In exchange Proxy Settings, the URL to my proxy server for Exchange is mail.domain.com Connect using SSL is checked On Slow Networks, connect using HTTP first then connect using TCP/ IP is checked. Authentication mode is NTLM (the same enabled in Exchange server). Please advise if there is something to do to allow users to connect directly to the Exchange server without supplying there passwords each time they open their outlooks.

My case: Exchange 2007 on Windows 2003 Server + RPC over HTTP proxy; Active Directory controller on Windows 2008 Server;Valid SSL certificate signed by verisign.com. Port 443 correctly forwarded on firewall. POP3, IMAP and SMTP works great.I have strange problem with RPC over HTTPS. My rpcping output:1. C:\Program Files\Windows Resource Kits\Tools>rpcping.exe -t ncacn_http -s MAIL -o RpcProxy=mail.mydomain.com -P "eject,MYDOMAIN,password" -I "eject,MYDOMAIN,password" -H 1 -u 10 -a connect -F 3 -v 3 -B msstd:mail.mydomain.com -E -R noneRPCPing v2.12. Copyright (C) Microsoft Corporation, 2002OS Version is: 5.1, Service Pack 2RPCPinging proxy server mail.mydomain.com with Echo Request PacketSending ping to serverResponse from server received: 200Pinging successfully completed in 969 ms2. C:\Program Files\Windows Resource Kits\Tools>rpcping.exe -t ncacn_http -s MAIL -o RpcProxy=mail.mydomain.com -P "eject,MYDOMAIN,password" -I "eject,MYDOMAIN,password" -H 1 -u 10 -a connect -F 3 -v 3 -e 6001RPCPing v2.12. Copyright (C) Microsoft Corporation, 2002OS Version is: 5.1, Service Pack 2Exception 1722 (0x000006BA)Of course I read KB article http://support.microsoft.com/kb/831051 and see Possible Cause for this error code: The RPC service cannot be contacted. You may receive this response because there are problems with the RPC Proxy server (if this is the case, you can use the E argument to verify that the RPC Proxy server is available), because the service stopped on Exchange 2003 backend server (for example store), because the Exchange 2003 backend server is down, because the ValidPorts registry key does not permit access to this server, because the ValidPorts registry key does not permit this port, because you tried to to access the EMP when it was not published (neither the e switch or port 593 were available), or because you tried to access UUID when EMP was not published (for example, you used the a switch without port 593 being available.).Other important thing - after reboot al settings which I made via rpccfg are replaced by default values. Why ? Anyway after adding via "rpccfg /ha ..." all ports what suggested 6001-6002, 593, 6004 rpcping results are same .C:\Documents and Settings\teject>rpccfg /hdServer Name Port Settings-------------------------------------------------------------------------------MAIL 6001-6002 6004mail.mydomain.com 6001-6002 6004Cannot figure out how fix this problem, may be somebody have ideas?Thanks!

I finally found solution for my problem. I noticed that I have IPv6 tcp/ip in my NIC properties on server where exchange 2007 and RPC proxy was installed. I uninstalled it, reboot ... and VOILA - everything works on client side!!! I'm wondered why there is no nothing about IPv6 problems with Exchange 2007 in documentation and books. Btw, I remember that I saw somewhere about possible problems with IPv6 on client side (Vista or Server 2008) - in my case ipv6 settings on client side doesn't matter (I played with changing it's settings). Also still have default IPV6 settings on my domain controller which runs under WindowsServer 2008. Hope that my post will be helpful for somebody else I like RPC over HTTPS

NadeemNasir wrote: Internally, if I try to start Outlook from a laptop that has been joined to the domain, I don't even see a logon screen, it opens right up which is the behavior I would expect from Oultook Anywhere from inside the domain. Changing your settings in outlook to NTLM (Advanced) Should fix your User Credentials box from popping up. As long as the laptop is joined to the domain. Infact you should never see it if you are caching your user accounts from your AD Server even when you are outside the office. As long as the Login and Outlook password are the same.

How does IPv6 effect Exchange 2007? I am having same problem with Outlook Anywhere as the rest of the posts here. My server certificates are good and show no errors. Can connect inside the domain OK but when outside my domain machines connect and will receive mail. However, they will not connect to the global address book, test user cannot add contacts and machine will not send messages. Any suggestions.................

this link solved problem for mehttp://blog.aaronmarks.com/?p=65

MINUTEMAN SentryPlus UPS program taking charge of Port 80 and messing up IIS or any other program intefering with ports reserved for OS . Outlook Anywhere did stop working, as other form of connection with server like remote.servername.com. Even local http:/servername is not available out of office assitant (Outlook) will not work till. Probably the service (IIS) will be turned to manual or gettin rid of crapy SentryPlus program.

http://msexchangeteam.com/videos/9/owamobility/entry446359.aspxsasanka

NadeemNasir, you need to ensure AutoDiscover is working properly. Her is the info: http://technet.microsoft.com/en-us/library/bb232838%28EXCHG.80%29.aspx.

I have proble with Outlook Anywhere I am running Exchange 2007 SP2 Installed the RPC Proxy service > Verified Network firewall allow connections to mail.mydomain.com on port 443 (ssl) > Can use OWA Trusted Public CA already running successfully with all required names including autodiscover. My problem is tht when i am trying to connect with Outlook client it prompts for User Name and login after Filling up valid username/password i cannot get log on to account ? what may be the possible issue ? Do any one have same issue please help me out. Thanks

are you created valid dns entry for the autodiscovery url ? check this out http://blogs.technet.com/b/jmayans/archive/2006/09/07/454716.aspxDishan M. Francis www.rebeladmin.com